-1

On ubuntu 16.04.3 / OpenSSH_7.2p2 disabling Tunneling globally by setting these values in /etc/ssh/sshd_config has no effect and Dynamic / Local tunnels still work

AllowAgentForwarding no
AllowTcpForwarding no
AllowStreamLocalForwarding no
PermitOpen none
PermitTunnel no
X11Forwarding no

Update: I can only make it work by using "Match" on selected User(s)

Match User zuser
  AllowTcpForwarding no
  X11Forwarding no
  AllowAgentForwarding no
  AllowStreamLocalForwarding no
  PermitOpen none
  PermitTunnel no
user3759159
  • 9
  • 1
  • 1
  • 3

2 Answers2

5

OpenSSH will unexpectedly apply settings when using Match and not apply settings when not using Match if at some earlier position in the configuration there is another Match block.

The following example demonstrates this:

Match Group sudo
  # this is applied to sudo members
  ClientAliveInterval 20
  # this is applied to sudo members
  AllowTcpForwarding yes

# one might assume that the Match block has ended here - it did not
# the following is ALSO applied to sudo members only
X11Forwarding
AllowTcpForwarding no

Though most configuration is using indentation for better readability, a Match does not end when indentation ends.

If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file

OpenSSH will only notice unintended configuration changes from inappropriate Match insertion if one of those options is not valid in that context. Otherwise, following instructions are simply becoming dependent on that Match condition.

The unexpected configuration can be resolved by inserting all Match blocks strictly at the very end of the configuration file - and placing all unconditional configuration strictly above the first Match line.

anx
  • 6,875
  • 4
  • 22
  • 45
3

This seems to work fine for me in a Vagrant box (openssh-server 1:7.2p2-4ubuntu2.2)

AllowTcpForwarding no

/var/log/auth.log:

Nov 22 16:19:41 packer-qemu sshd[1164]: refused local port forward: originator 127.0.0.1 port 44540, target localhost port 22 Nov 22 16:19:46 packer-qemu sshd[1164]: refused local port forward: originator 127.0.0.1 port 44546, target localhost port 22

Are you sure you don't have something else in your configuration file which overrides your setting somehow? (Like a match statement)

Nils
  • 301
  • 1
  • 3